disable patch via debugfs before module unload

Currently the patch module calls kpatch_unregister in the patch module
exit path.  If the activeness safety check fails in kpatch_unregister,
it's too late for the patch module to stop exiting, so all it can do is
panic.

Prevent this scenario by requiring the user to disable the patch module
via debugfs before unloading the module.  The debugfs write will fail if
the activeness safety check fails.  The rmmod will fail if the patch is
still enabled.

Also add support for this new unloading model in "kpatch unload".
kmod/core: NMI fixes

After doing a lot of thinking, here is an attempt to simplify and
improve the correctness of the NMI handling:

- There was a race in kpatch_ftrace_handler between the kpatch_get_func
  and kpatch_finish_status calls which could result in func being NULL.
  The retry was supposed to fix this.  However, this race would still be
  a problem in the repatching case (if the function had already been
  previously patched), in which case func would not be NULL, but could
  instead point to the previously patched version of the function.

  The fix is to use a memory barrier between accesses of the func hash
  and the status variable, and then just call kpatch_get_func *after*
  accessing the status variable.  For OP_PATCH, if status is SUCCESS,
  then func is guaranteed to point to the new function.  If status is
  FAILURE, func might point to the new function, in which case we can
  use committed_func to get the previous version of the function.

  This has another benefit of making the code easier to understand.

- Move the "funcs[i].updating = false" loop outside of stop machine.  It
  doesn't need to be in stop machine, and I think it was making the code
  harder to understand.  Instead move it to much later, after setting
  KPATCH_OP_NONE.  (With a future commit I have planned for atomic
  module replacing, it will need to be after setting KPATCH_OP_NONE
  anyway).

- Remove synchronize_rcu() from the error path.  After a lot of
  thinking, I can't think of any reason for it being there and the
  comment doesn't clarify it for me.  Masami, am I missing something?

- Add synchronize_rcu() after setting KPATCH_OP_NONE to ensure that all
  existing ftrace handlers running in NMI context will exit before we
  make any future changes to the shared state variables.
foo